Debugging Symantec Endpoint Protection (SEP) with Dr.Watson

Procedure:

1. Start > Run > drwtsn32
2. The Location: “C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson” is where we have Dr. Watson logs generated

• drwtsn32.log (basic application & process log)
• user.dmp (CRASH DUMP)

How to obtain an Application Dump File using Dr. Watson ?

1. Number of instructions should be set to 100
2. Crash Dump Type should be set to FULL
3. Enable Checkbox for:

• Dump Symbol Tables
• Dump All Thread Contexts
• Create Crash Dump File
  

How to obtain an Application Dump File using Dr. Watson ?

1. Finding out what tool is currently used as a “default application exception handler” can be obtained by looking at the registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug 
2. If this is set to drwtsn32 then nothing needs to be done. If another tool is there you will need to reset it to Dr. Watson. This is done by doing the following

• Click Start, and then click Run.
• Type drwtsn32 -i, and then click OK

Use of Dr.Watson to force a kill for OK TO END process in SEP

1. DR. WATSON can also be used to KILL a non-responsive process
2. Example: 

• Start > Run
• Type drwtsn32 –p lucallbackproxy.exe OR
• Type drwtsn32 –p 1024 (process ID)